Security audit
Security checks for vulnerabilities and agentic risk
The skill publishes user-approved Google Business Profile posts using disclosed Google authorization and local credential storage.
Use your own Google Cloud OAuth client and consider the broad business.manage permission before signing in. Protect the stored refresh token, and check the business location, text, and public photo URLs before approving each post. Review socialkit-social-core separately because its initialization and approval implementation was not supplied. The bundled review and analytics callbacks are inactive in these commands.
Referenced artifact was not completely inspected
- Find options.location with `node scripts/auth.mjs --platform google-business --locations`.
Referenced artifact was not completely inspected
1. Sign in once (browser, local redirect): `node scripts/auth.mjs --platform google-business`
Referenced artifact was not completely inspected
3. Write `post.json` (text, media with alt text, options). See `node scripts/publish.mjs --help`.
Referenced artifact was not completely inspected
4. Validate: `node scripts/publish.mjs --check --dir gbp-<slug>`
Referenced artifact was not completely inspected
6. Publish: `node scripts/publish.mjs --publish --dir gbp-<slug>` and report the result.
Without declared permissions the skill's intent is opaque and cannot be validated.
The metrics callback retrieves 30 days of location-wide search and Maps impressions, website clicks, calls, and direction requests. These are business analytics rather than operations needed to publish an approved update, event, or offer; the supplied post ID is used only to identify the location.
The comments callback retrieves location-wide reviews, including reviewer names, ratings, and review text, while the reply callback issues a PUT request to publish a review reply. Managing customer reviews is distinct from publishing Google Business Profile updates, events, or offers and is not justified by the stated purpose.
The comments method retrieves location reviews, including reviewer names and review text, while reply modifies a review reply through an authenticated PUT request. These are business-review management capabilities rather than update, event, or offer publication; although the publishing runner does not invoke them, they are implemented in this skill's adapter.
The metrics method requests 30 days of location-wide search and Maps impressions, website clicks, calls, and direction requests from the Business Profile Performance API. These analytics are not needed to publish an approved update, event, or offer and are not declared in the manifest; the publishing runner does not invoke this method.